Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Why is there information missing in objdump?

Tags:

objdump

I can't manage to find out why there are sometime some .words missing in my assembly code when I run objdump. What do the "..." alone on a line represent?

like image 743
watiss Avatar asked Jan 09 '14 12:01

watiss


1 Answers

Inside of the objdump output of -d or -D (disassemble), there will often be multiple instances of lines containing only an ellipsis. This is only because all the bytes between the above and below bytes are all null (0x00).

Below is the output of a disassembled 32bit program. Between the offset of 00234(+4) and 00240 are all 0x00 inside of the executable file.

40022c: 00000034    0x34
400230: 0000016a    0x16a
400234: 000001ac    0x1ac
  ...
400240: 00000098    0x98
400244: 00000000    nop
400248: 000000a9    0xa9
  ...
400254: 000000cf    0xcf

Looking at the application we disassembled, you can see that where the ellipsis occurs is all null bytes. No point in outputting these to the user multiple times, so objdump simply removes them. The bold text is where the ellipsis occur. I should also note, that if there is only one section (32 / 64bits) of null bytes, objdump will show this as nop or similar depending on machine.

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000220                                      34 00 00 00              4...
00000230  6A 01 00 00 AC 01 00 00 00 00 00 00 00 00 00 00  j...¬...........
00000240  98 00 00 00 00 00 00 00 A9 00 00 00 00 00 00 00  ˜.......©.......
00000250  00 00 00 00 CF 00 00 00                          ....Ï...
like image 92
David Avatar answered Oct 02 '22 06:10

David